Feat/remote file

[jaroug]

Add support for probing a remote PEM file over http/https

This is a corner case to be able to monitor BIMI related certificates

• https://support.google.com/a/answer/10911320
• https://support.google.com/a/answer/10911321

[dragoangel]

Looks nice

[ribbybibby]

Thank you for this PR and sorry for taking so long to review it!

I have a few comments

1. I don't think this should export ssl_file_cert_* metrics. We should just read the certificates out of the response body and export the regular ssl_cert_* metrics. We don't need the intermediate step where we write them to disk.
2. This also exports metrics from the TLS connection because it reuses the tls config used in the https prober:

   ssl_exporter/prober/tls.go

   Line 30 in 42d1d4f

   return collectConnectionStateMetrics(state, registry)

   . I don't think it should do this. It should only export metrics for the certificates returned in the response body.
3. Can you please improve the tests so that they actually verify the exported metrics?

[jaroug]

Hi :) no worries I'm glad the project is still alive.

I made the changes requested, at least I hope it matches your expectations. I honestly can't remember why I thought it was a good idea to download the file 😅

[dragoangel]

LGTM

[dragoangel]

@ribbybibby can you please review if this PR now is okay?

[ribbybibby]

Changes suggested/requested in comments.

[ribbybibby]

Thank you for the contribution @jaroug. I've made some of my suggested changes and fixed some other things up and now I think this is good to merge.

[dragoangel]

@ribbybibby can we get 2.5.0 released with this feature please? 🙏

[dragoangel]

@ribbybibby kind reminder - this feature not get into 2.4.3 release, as it was been released before merging this branch.

[dragoangel]

@jaroug btw, I found out that ssl_verified_cert_not_after not available as metrics for http_file, is this desired behavior?

I get managed to create alert for ssl_cert_not_after only if ssl_verified_cert_not_after not exist for instance, but it was a bit challenging:

    (
      (
        ssl_cert_not_after{namespace="external-ssl-monitor"}
        - time()
      ) < 86400 * 14
    )
    unless
    sum without (chain_no) (
      ssl_verified_cert_not_after{chain_no="0",namespace="external-ssl-monitor"}
    )